To detect data staging before exfiltration, which action would be most effective?

• A. Analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
• B. Identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
• C. Monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
• D. Identify the attack at an ini

Answer: (B)